To comply with the GDPR, schools need to need to consider how staff practices and behaviours need to change. Dai Durbridge explores how to implement a cultural change to reduce the risk of a data breach